String result = markdownRenderer.render(malicious);
        // onerror attribute should be removed
        assertFalse(result.contains("onerror"));
    }

    @Test
    public void test_render_xss_iframeTag() {
        String malicious = "<iframe src=\"http://evil.com\"></iframe>";
        String result = markdownRenderer.render(malicious);
        // iframe tags should be removed